How to Create a Strong Password (Length Beats Complexity)

Password advice has changed. Rules such as "use a capital, a number and a symbol" produce passwords that are hard to remember and, often, easy to guess. What matters is how random and how long a password is.

Measuring strength: entropy

Entropy is measured in bits. Each extra bit doubles the number of guesses an attacker needs. For a password made of characters picked at random:

Entropy (bits) = length × log2(number of possible characters)

The key words are at random. This formula applies to generated passwords, not to ones a person invents, which follow patterns.

Length against complexity

Sixteen random lowercase letters are stronger than eight characters using every type. Adding length is the cheapest way to add strength, because it multiplies the search space each time.

Passphrases

A passphrase made of random words is easier to type and remember. If each word is picked at random from a list of 7,776 words, each word adds about 12.9 bits, so four words give roughly 52 bits and six give about 78. The words must be chosen by a random process, not by you, and not taken from a quote or a lyric.

The habits that matter more

1. Use a different password for every account. When one site is breached, reused passwords let attackers try them elsewhere.
2. Use a password manager. It generates and stores long random passwords, so you only remember one strong passphrase.
3. Turn on two-step verification, preferably with an authenticator app or a security key. Passkeys, where offered, remove the password altogether.
4. Change a password when there is a reason, such as a breach notice, rather than on a schedule. Current guidance from bodies such as NIST discourages forced periodic changes and arbitrary composition rules.

What to avoid

• Personal details such as names, birthdays and pets.
• Keyboard patterns and common substitutions like "P@ssw0rd".
• Adding a number to the end of an old password.
• Sharing passwords by email or chat.

Using a generator

A generator picks each character independently using a secure random source, which is what the entropy formula assumes. The password generator runs in your browser and never sends the result anywhere.